FINMA Guidance 05/2020: duty to report the cyber attacks

The protection of both the individuals and the financial markets with regard to cyber-attacks are considered of substantial importance.

The main focus is on products or services of supervised institutions and their underlying business processes as well as their critical assets, where the cyber-attack can lead to the failure or dysfunction. This may damage the protective goal of availability, integrity and confidentiality of information. The importance of infrastructure security was also highlighted in the Direct transmission revision, which called for more stringent digital communication standards. Such attacks can also jeopardise the data. In parallel, reforms such as the Banking act revision have underscored the need to align operational integrity with secure digital infrastructures.

If a cyber-attack on critical assets results in one or more of the protective goals of essential functions and the business processes are under risk - this must be reported to FINMA immediately.

The affected supervised institution reports to FINMA through the responsible (Key) Account Manager within 24 hours of detecting the cyber-attack and manages an initial evaluation of it. The actual report should be provided within 72 hours via the FINMA web-based survey and application platform (EHP)7,8. Just as in the Gold trade transparency initiative, institutions must commit to timely and accurate disclosures to prevent systemic vulnerabilities.

If the new developments under the same cyber-attack occur (after the report to FINMA), a new report should be provided within 72 hours. These procedures complement broader transparency frameworks such as the Automatic information exchange, further reinforcing trust in Swiss institutions.